Phishing via Google Storage Abuse Leading to RAT Deployment

Any[.]run identified a multi-stage phishing campaign using a Google Drive-themed lure and delivering Remcos RAT. Attackers place the HTML on storage[.]googleapis[.]com, abusing trusted infrastructure instead of hosting the phishing page on a newly registered domain. The chain leverages RegSvcs.exe, a legitimate signed Microsoft/.NET binary with a clean VirusTotal hash. Combined with trusted hosting, this makes reputation-based detection unreliable and lowers alert priority during triage. File reputation alone is not enough. Detection depends on behavioral analysis and sandboxing. The page mimics a Google Drive login form, collecting email, password, and OTP. After a “successful login,” the victim is prompted to download Bid-Packet-INV-Document.js, triggering a multi-stage delivery chain: S (WSH launcher + time-based evasion) -> VBS Stage 1 (download + hidden execution) -> VBS Stage 2 (%APPDATA%\WindowsUpdate + Startup persistence) -> DYHVQ.ps1 (loader orchestration) -> ZIFDG.tmp (obfuscated PE / Remcos payload) -> Textbin-hosted obfuscated .NET loader (in-memory via Assembly.Load) -> %TEMP%\RegSvcs.exe hollowing/injection -> Partially fileless Remcos + C2 Analysis session: TI Lookup query: domainName: and domainName:storage.googleapis.com and threatLevel:malicious IOCs Phishing URLs: hxxps://storage[.]googleapis[.]com/pa-bids/GoogleDrive.html hxxps://storage[.]googleapis[.]com/com-bid/GoogleDrive.html hxxps://storage[.]googleapis[.]com/contract-bid-0/GoogleDrive.html hxxps://storage[.]googleapis[.]com/in-bids/GoogleDrive.html hxxp://storage[.]googleapis[.]com/out-bid/GoogleDrive.html Credential exfiltration domains: usmetalpowders[.]co iseeyousmile9[.]com Credential exfiltration path: /1a/uh.php Malware staging host: brianburkeauction[.]com Source: r/ANYRUN submitted by /u/malwaredetector [link] [ ]